Re: [syslog-sec] Re: timestamps and timezones (was: time-sync)

[by way of "Chris M. Lonvick" <[EMAIL PROTECTED]>]

On Wed, Oct 20, 1999 at 05:13:54PM -0400, Robert Webber wrote:
 > At 08:53 PM 10/20/1999 +0200, you wrote:
 > >On Wed, Oct 20, 1999 at 02:11:55PM -0300, Emiliano Kargieman wrote:
 > >> a good idea, given that we don't end
 > >> up with an HTTP-like protocol that opens a TCP connection for every little
 > >> 100byte packet. The overhead is just too much. I'd rather go for keeping
 > >> one single TCP connection open for each host we are logging to.
 > ...
 > >With this I _dont_ want to maintain that UDP is better than TCP for
 > >syslog2, simply I think that to choose TCP without a deep analysis may
 > >be an error. So since seems that both UDP and TCP have some advantages
 > >a good solution may be to design a protocol that can be simply implemented
 > >using both TCP and UDP.
  
 > I agree.  Make the core functionality work on UDP as a universal transport
 > and it will also work over TCP.  Also allow options which require a TCP
 > connection to work properly, but don't make them part of the baseline
 > requirements if that can be avoided.

This sounds okay.  However, I think that the syslog protocol should, 
overall, remain as independent as possible of the transport mechanism(s) 
being used to send messages from clients to servers.  The reason for 
this is to accommodate implementations for uncommon network 
protocols and those wishing to implement the protocol without using 
a network at all. 

Keeping backwards compatibility with traditional syslog by accepting
its UDP messages is a useful goal--I don't really like the idea
of running two syslog daemons speaking two entirely different protocols 
just to be able to accept syslog messages from old applications which 
don't know about the new syslog.  Much of this will be dealt with 
in changes to the various syslog APIs for various platforms, but 
there are cases where it wouldn't; dedicated firewalls, routers, 
statically-linked applications, and terminal servers are just
some of the things that come to mind..

--
<[EMAIL PROTECTED]>